A4 Artikkeli konferenssijulkaisussa
A Case-Control Study on the Server-Side Bandages Against XSS

Julkaisun tekijät: Ruohonen J., Leppänen V.
Kustantaja: CEUR-WS
Julkaisuvuosi: 2018
Journal: CEUR Workshop Proceedings
Kirjan nimi *: Proceedings of the Seventh Workshop on Software Quality Analysis, Monitoring, Improvement, and Applications
Tietokannassa oleva lehden nimi: CEUR Workshop Proceedings
Volyymi: 2217
ISBN: 978-86-7031-473-3


This paper surveys the server-side use of security-related options for protecting websites against cross-site scripting (XSS) attacks. By using data from a bug bounty platform, the use of these header-based options is approached with a case-control study that contrasts popular Internet domains against less popular domains that have explicitly been veried to have been vulnerable to XSS. According to the results based on the analysis of nearly 800 thousand domains, (a) the header-based security options are only infrequently used. However, (b) the domains known to have been vulnerable to XSS have been much less likely to use these options compared to popular domains. Furthermore, (c) the options surveyed tend to statistically form clear latent dimensions, which can be speculated to relate to the eort required to enforce strict security policies for websites.

Ladattava julkaisu

This is an electronic reprint of the original article.
This reprint may differ from the original in pagination and typographic detail. Please cite the original version.

Last updated on 2019-29-01 at 15:06